User Guide

Synapse Yara Grid adds Storm commands for conducting file matching using the YARA tool. Additional Storm commands are also added for validating rules and analyzing a file against a set of rules.

Getting Started

Check with your Admin to enable permissions.

Examples

Validate a rule

For rules that are syntactically invalid, the Yara syntax error output would be printed.

> it:app:yara:rule#my.rules | yara.validate
it:app:yara:rule=01738b8891281132320801d2ef56f212
        .created = 2025/01/17 14:49:10.832
        :name = test.yara
        :text = rule SimpleTestRule
                {
                meta:
                  author = "Vertex project"
                strings:
                  $string0 = "key"
                  $string1 = "valu"
                condition:
                  all of them
                }

        #my.rules

Match files against rules by tag

> file:bytes#my.files | yara.match --rules ${ #my.rules } --yield
it:app:yara:match=('01738b8891281132320801d2ef56f212', 'sha256:34549c8136bb1e0bc6de426202a4d93f59e479072d12eda6dc3841562240d606')
        .created = 2025/01/17 14:49:13.234
        :file = sha256:34549c8136bb1e0bc6de426202a4d93f59e479072d12eda6dc3841562240d606
        :rule = 01738b8891281132320801d2ef56f212
        :version = 0.0.0

Use of meta:source nodes

Synapse Yara Grid uses a meta:source node and -(seen)> light weight edges to track nodes created by the power-up.

> meta:source=14b4a81b910d6cc5da902f6a072fcbc3
meta:source=14b4a81b910d6cc5da902f6a072fcbc3
        .created = 2025/01/17 14:49:13.227
        :name = synapse yara grid service

Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse Yara Grid. The following example shows how to filter the results of a query to include only results observed by Synapse-Yara:

> it:app:yara:rule#my.rules -> it:app:yara:match +{ <(seen)- meta:source=14b4a81b910d6cc5da902f6a072fcbc3 }
it:app:yara:match=('01738b8891281132320801d2ef56f212', 'sha256:34549c8136bb1e0bc6de426202a4d93f59e479072d12eda6dc3841562240d606')
        .created = 2025/01/17 14:49:13.234
        :file = sha256:34549c8136bb1e0bc6de426202a4d93f59e479072d12eda6dc3841562240d606
        :rule = 01738b8891281132320801d2ef56f212
        :version = 0.0.0